EUVD-2025-209829
GHSA-frpq-7mr9-hx8p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses, the WDU utilizes WebSockets to control settings, including administrative settings. This allows a network attacker to take full control of a WDU. To initiate an exploit of this vulnerability, the victim must (1) be utilizing a web browser on a multihomed host that has local interfaces on the Garmin Marine Network as well as another network, and (2) access a malicious third party website created by the attacker.
AnalysisAI
Cross-site WebSocket hijacking in Garmin WDU v1 1.4.6 and v2 5.0 allows remote attackers to gain full administrative control of the marine network device. Exploitation requires the victim to browse a malicious website while connected to both the Garmin Marine Network and another network simultaneously. EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation, but CVSS 9.3 reflects severe potential impact when conditions are met - this is a high-impact, low-probability threat primarily relevant to maritime environments with dual-network configurations.
Technical ContextAI
The Garmin Wireless Display Unit (WDU) is a marine navigation display that operates a locally-served web interface for configuration and control. The vulnerability stems from CWE-352 (Cross-Site Request Forgery), specifically manifesting as cross-origin WebSocket hijacking. WebSockets, unlike traditional HTTP, do not enforce same-origin policy restrictions by default, requiring explicit origin validation by the server. The WDU's WebSocket endpoint accepts connections without validating the Origin header, allowing a malicious website to establish a WebSocket connection from the victim's browser to the local WDU interface. Since the browser automatically includes authentication cookies or credentials, the attacker gains authenticated access to administrative WebSocket commands used to control device settings.
RemediationAI
Contact Garmin support at https://garmin.com for firmware updates addressing CVE-2025-27851 - specific patched firmware version not independently confirmed from available data sources. Until patching is completed, implement network segmentation to isolate the Garmin Marine Network from general-purpose computing devices with internet access, preventing the dual-network prerequisite required for exploitation. Configure firewall rules to block outbound WebSocket connections from marine network interfaces to external networks. Disable the WDU's web management interface when not actively needed for configuration tasks. Deploy browser extensions or endpoint policies on multihomed systems to restrict WebSocket connections to trusted origins only. Note that network isolation is the most effective compensating control but may impact legitimate remote monitoring workflows if marine operators require simultaneous access to vessel networks and external resources.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today